Cloud Security Fundamentals Cheat Sheet
Foundational cloud security concepts including the shared responsibility model, encryption, network controls, and identity hardening.
2 PagesIntermediateFeb 5, 2026
Least-Privilege IAM Policy (AWS)
Scoped policy granting only what's needed, nothing more.
json
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/reports/*", "Condition": { "IpAddress": {"aws:SourceIp": "203.0.113.0/24"} } } ]}
Restrictive Security Group (AWS CLI)
Allow SSH only from a known IP range, not 0.0.0.0/0.
bash
aws ec2 authorize-security-group-ingress \ --group-id sg-0123456789abcdef0 \ --protocol tcp --port 22 \ --cidr 203.0.113.0/24
Core Security Controls
Key core security controls to know.
- Encryption at Rest- Protects stored data using provider-managed or customer-managed keys (KMS)
- Encryption in Transit- TLS/HTTPS protects data moving between services and clients
- Network Segmentation- VPCs/VNets, subnets, and security groups restrict lateral movement
- MFA- Multi-factor authentication drastically reduces credential-theft risk, especially for privileged accounts
- CSPM (Cloud Security Posture Management)- Continuously scans for misconfigurations against best-practice benchmarks (e.g. CIS)
- Audit Logging- CloudTrail/Activity Log/Cloud Audit Logs record every API call for forensics and compliance
Customer-Managed KMS Key Policy
Restrict key usage to specific roles and enforce encryption context for auditability.
json
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowKeyAdmin", "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::111122223333:role/KeyAdmin"}, "Action": ["kms:Create*", "kms:Describe*", "kms:PutKeyPolicy"], "Resource": "*" }, { "Sid": "AllowUseWithContext", "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::111122223333:role/AppRuntime"}, "Action": ["kms:Decrypt", "kms:GenerateDataKey"], "Resource": "*", "Condition": { "StringEquals": {"kms:EncryptionContext:app": "billing-service"} } } ]}
Service Control Policy — Deny Non-Approved Regions
Org-level guardrail that blocks resource creation outside approved regions, even for account admins.
json
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyOutsideApprovedRegions", "Effect": "Deny", "NotAction": ["iam:*", "organizations:*", "route53:*", "cloudfront:*", "support:*"], "Resource": "*", "Condition": { "StringNotEquals": { "aws:RequestedRegion": ["us-east-1", "eu-west-1"] } } } ]}
S3 Bucket Policy — Deny Public Access & Enforce TLS
Explicit deny statements close common misconfiguration paths that Block Public Access alone can miss.
json
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyInsecureTransport", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"], "Condition": {"Bool": {"aws:SecureTransport": "false"}} }, { "Sid": "DenyUnencryptedUploads", "Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::my-bucket/*", "Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}} } ]}
Cross-Account Role Assumption with External ID
Third-party/vendor access pattern that prevents the confused-deputy problem.
bash
# Trust policy on the role in the target account requires an ExternalIdaws sts assume-role \ --role-arn arn:aws:iam::444455556666:role/VendorAccessRole \ --role-session-name audit-session \ --external-id "unique-shared-secret-per-vendor" \ --duration-seconds 3600
Advanced Threat Detection & Response
Services and patterns that go beyond baseline hardening into continuous detection and response.
- GuardDuty / Defender for Cloud- ML-based threat detection over VPC flow logs, DNS logs, and CloudTrail; flags cryptomining, credential exfiltration, recon
- Zero Trust Architecture- Never trust network location alone; every request is authenticated and authorized per-session (e.g. BeyondCorp, service mesh mTLS)
- Container Image Scanning- Scan images in the registry (ECR scan-on-push, Trivy) for known CVEs before deployment
- Secrets Manager Rotation- Automatic credential rotation via Lambda rotation functions removes long-lived static secrets
- SCP / Organization Guardrails- Preventive controls enforced at the AWS Organizations level, unbypassable by account-level IAM
- Immutable Infrastructure- Patch by replacing instances/images from a golden AMI rather than SSHing in, reducing config drift and attack surface
- SIEM Correlation- Centralize CloudTrail, VPC flow logs, and app logs for cross-signal correlation (e.g. Splunk, Security Lake)
Pro Tip
Treat public storage buckets and open security groups (0.0.0.0/0) as the default failure mode to guard against — misconfigured access controls, not sophisticated exploits, cause the vast majority of real-world cloud breaches.
Was this cheat sheet helpful?
Explore Topics
#CloudSecurityFundamentals#CloudSecurityFundamentalsCheatSheet#CloudComputing#Intermediate#Least#Privilege#IAM#Policy#Networking#Security#CheatSheet#SkillVeris
